@objectstack/platform-objects 10.2.0 → 11.0.0

package/dist/index.js

@@ -37,6 +37,13 @@ var SysUser = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
+      // Org invitations are a multi-org-only flow (the endpoint resolves
+      // an active org that does not exist in single-org mode). Hide the
+      // affordance unless multi-org is enabled — matching the
+      // `create_organization` gate on sys_organization. This action is the
+      // most exposed of the set because the Users list is always reachable
+      // in single-org, unlike the org/membership lists.
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -80,6 +87,21 @@ var SysUser = data.ObjectSchema.create({
       successMessage: "User unbanned",
       refreshAfter: true
     },
+    {
+      // ADR-0069 D2 — clear a brute-force lockout early (locked_until auto-
+      // expires, but an admin can release a user immediately). Hits the
+      // plugin-auth custom route, which is admin-guarded server-side.
+      name: "unlock_user",
+      label: "Unlock Account",
+      icon: "lock-open",
+      variant: "secondary",
+      locations: ["list_item"],
+      type: "api",
+      target: "/api/v1/auth/admin/unlock-user",
+      recordIdParam: "userId",
+      successMessage: "Account unlocked",
+      refreshAfter: true
+    },
     {
       name: "set_user_password",
       label: "Set Password",
@@ -156,7 +178,11 @@ var SysUser = data.ObjectSchema.create({
       locations: ["record_header", "record_more", "record_section"],
       type: "api",
       target: "/api/v1/auth/change-password",
-      visible: "record.id == ctx.user.id",
+      // Managed (IdP-provisioned) users hold no local credential — hide the
+      // password form so they can't self-mint a password that bypasses
+      // enforced SSO. The break-glass owner (env-native, or flipped back when
+      // their break-glass password is set) keeps it. ADR-0024 D4/D5.2.
+      visible: 'record.id == ctx.user.id && record.source != "idp_provisioned"',
       successMessage: "Password changed",
       refreshAfter: false,
       params: [
@@ -173,7 +199,9 @@ var SysUser = data.ObjectSchema.create({
       locations: ["record_header", "record_more", "record_section"],
       type: "api",
       target: "/api/v1/auth/change-email",
-      visible: "record.id == ctx.user.id",
+      // A managed user's email is owned by the IdP — a local change would
+      // desync. Hide for IdP-provisioned; env-native users keep it.
+      visible: 'record.id == ctx.user.id && record.source != "idp_provisioned"',
       successMessage: "Verification email sent \u2014 check the new address to confirm.",
       refreshAfter: false,
       params: [
@@ -204,7 +232,9 @@ var SysUser = data.ObjectSchema.create({
       locations: ["record_more", "record_section"],
       type: "api",
       target: "/api/v1/auth/delete-user",
-      visible: "record.id == ctx.user.id",
+      // Self-delete needs a local password; managed users are deprovisioned
+      // via the IdP (org-removal / SCIM), not local self-service. Hide for them.
+      visible: 'record.id == ctx.user.id && record.source != "idp_provisioned"',
       confirmText: "Permanently delete your account? This cannot be undone \u2014 all your sessions will be terminated and all data you own will be removed per the configured retention policy.",
       successMessage: "Account deleted",
       refreshAfter: false,
@@ -287,7 +317,7 @@ var SysUser = data.ObjectSchema.create({
       name: "all_users",
       label: "All Users",
       data: { provider: "object", object: "sys_user" },
-      columns: ["name", "email", "email_verified", "two_factor_enabled", "created_at"],
+      columns: ["name", "email", "email_verified", "source", "two_factor_enabled", "created_at"],
       sort: [{ field: "name", order: "asc" }],
       pagination: { pageSize: 50 }
     },
@@ -374,6 +404,32 @@ var SysUser = data.ObjectSchema.create({
       group: "Admin",
       description: "When set, the ban auto-clears at this time."
     }),
+    // ── Anti-brute-force (ADR-0069 D2) — owned by objectql, better-auth is
+    //    oblivious. The auth manager's sign-in hooks maintain these: failures
+    //    increment the counter; crossing `lockout_threshold` stamps
+    //    `locked_until`; a successful sign-in resets both. Admins can clear
+    //    them early via the Unlock action.
+    failed_login_count: data.Field.number({
+      label: "Failed Login Count",
+      required: false,
+      defaultValue: 0,
+      readonly: true,
+      group: "Admin",
+      description: "Consecutive failed sign-in attempts; reset to 0 on success. Maintained by the auth manager."
+    }),
+    locked_until: data.Field.datetime({
+      label: "Locked Until",
+      required: false,
+      readonly: true,
+      group: "Admin",
+      description: "When set and in the future, sign-in is rejected (brute-force lockout). Auto-clears past this time; an admin can clear it early via Unlock."
+    }),
+    ai_access: data.Field.boolean({
+      label: "AI Access",
+      defaultValue: false,
+      group: "Admin",
+      description: "Whether this user holds an AI seat \u2014 grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
+    }),
     // ── Profile ──────────────────────────────────────────────────
     image: data.Field.url({
       label: "Profile Image",
@@ -394,6 +450,28 @@ var SysUser = data.ObjectSchema.create({
       description: "The user's primary business unit \u2014 a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
     }),
     // ── System (auto-managed, hidden from create/edit forms) ─────
+    // Identity provenance (ADR-0024 D4). `idp_provisioned` users were
+    // JIT-created on first federated login (a `sys_account` exists for an
+    // external/OIDC provider — e.g. the cloud-as-IdP `objectstack-cloud`
+    // provider, or a customer's own IdP); `env_native` users registered
+    // locally (email/password) or are app end-users. Stamped automatically by
+    // the AuthManager `account.create.after` hook — never edited by hand.
+    // Drives the managed-vs-native user-mgmt UI gating (the password /
+    // identity-edit actions hide for managed users, who hold no local
+    // credential) and is the marker SCIM lifecycle keys off. Owned by objectql
+    // (better-auth is oblivious to this column — like `ai_access`).
+    source: data.Field.select({
+      label: "Identity Source",
+      required: false,
+      readonly: true,
+      group: "System",
+      defaultValue: "env_native",
+      options: [
+        { label: "IdP-Provisioned", value: "idp_provisioned" },
+        { label: "Env-Native", value: "env_native" }
+      ],
+      description: "How this identity was created \u2014 idp_provisioned (federated SSO JIT) or env_native (local signup / app end-user). System-managed; do not edit."
+    }),
     id: data.Field.text({
       label: "User ID",
       required: true,
@@ -759,6 +837,16 @@ var SysAccount = data.ObjectSchema.create({
       label: "Password Hash",
       required: false,
       description: "Hashed password for email/password provider"
+    }),
+    // ADR-0069 D1 — bounded ring of previous password hashes (JSON array of
+    // strings), used to reject password reuse on change/reset. Maintained by
+    // the auth manager; never exposed in UI.
+    previous_password_hashes: data.Field.textarea({
+      label: "Previous Password Hashes",
+      required: false,
+      readonly: true,
+      hidden: true,
+      description: "JSON array of prior password hashes (bounded by password_history_count); reuse-prevention only. System-managed."
     })
   },
   indexes: [
@@ -824,7 +912,13 @@ var SysVerification = data.ObjectSchema.create({
     })
   },
   indexes: [
-    { fields: ["value"], unique: true },
+    // `value` must NOT be unique. better-auth's oauth-provider stores OIDC
+    // authorization codes in this table with `value` = a JSON blob keyed by
+    // user+client+state, which can legitimately repeat. A UNIQUE constraint
+    // makes `/api/v1/auth/oauth2/authorize` fail (`UNIQUE constraint failed:
+    // sys_verification.value`) → 503, breaking cloud-as-IdP SSO entirely.
+    // better-auth keys verification lookups on `identifier`, not `value`.
+    { fields: ["value"], unique: false },
     { fields: ["identifier"], unique: false },
     { fields: ["expires_at"], unique: false }
   ],
@@ -892,6 +986,10 @@ var SysOrganization = data.ObjectSchema.create({
       recordIdParam: "organizationId",
       // better-auth `organization/update` nests editable fields under `data`.
       bodyShape: { wrap: "data" },
+      // Org-admin actions are multi-org-only; hide them in single-org for
+      // consistency with `create_organization` (the org list is empty there,
+      // but this also guards direct record-URL access).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Organization updated",
       refreshAfter: true,
       params: [
@@ -910,6 +1008,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/delete",
       recordIdParam: "organizationId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Delete this organization? All members will lose access immediately. This cannot be undone.",
       successMessage: "Organization deleted",
       refreshAfter: true
@@ -928,6 +1027,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/set-active",
       recordIdParam: "organizationId",
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Active organization switched",
       refreshAfter: true
     },
@@ -944,6 +1044,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/leave",
       recordIdParam: "organizationId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Leave this organization? You will lose access to all of its resources.",
       successMessage: "You have left the organization",
       refreshAfter: true
@@ -965,6 +1066,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/cloud/organizations/{id}/change-slug",
       method: "POST",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Renaming the slug rewrites every platform subdomain for this org and parks the old slug for 90 days. Continue?",
       successMessage: "Organization slug changed",
       refreshAfter: true,
@@ -1063,7 +1165,10 @@ var SysMember = data.ObjectSchema.create({
     docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
   },
   description: "Organization membership records",
-  titleFormat: "{user_id} in {organization_id}",
+  // Org-independent title: organization_id is null in single-org mode, so a
+  // '{user_id} in {organization_id}' format renders "… in null". User + role
+  // identifies the membership in both single- and multi-org deployments.
+  titleFormat: "{user_id} ({role})",
   compactLayout: ["user_id", "organization_id", "role"],
   // Row-level actions: better-auth `organization/update-member-role` and
   // `organization/remove-member`. Generic CRUD is suppressed on better-auth
@@ -1084,6 +1189,11 @@ var SysMember = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/add-member",
+      // Org-membership mutations are multi-org-only: the better-auth
+      // endpoints resolve an active org that does not exist in single-org
+      // mode, so these actions would fail at the API. Gate every one on
+      // the multi-org flag (mirrors sys_organization.create_organization).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Member added",
       refreshAfter: true,
       params: [
@@ -1101,6 +1211,7 @@ var SysMember = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Member role updated",
       refreshAfter: true,
       params: [
@@ -1117,6 +1228,7 @@ var SysMember = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-member",
       recordIdParam: "memberIdOrEmail",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Remove this member from the organization? They will lose access to all org resources.",
       successMessage: "Member removed",
       refreshAfter: true
@@ -1138,7 +1250,7 @@ var SysMember = data.ObjectSchema.create({
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
       bodyExtra: { role: "owner" },
-      visible: "record.role != 'owner'",
+      visible: "record.role != 'owner' && features.multiOrgEnabled != false",
       confirmText: "Transfer ownership of this organization to the selected member? You will be demoted to admin and lose owner-only privileges.",
       successMessage: "Ownership transferred",
       refreshAfter: true
@@ -1223,7 +1335,10 @@ var SysInvitation = data.ObjectSchema.create({
     docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
   },
   description: "Organization invitations for user onboarding",
-  titleFormat: "Invitation to {organization_id}",
+  // Title by invitee email rather than organization_id: the latter is null in
+  // single-org mode (renders "Invitation to null"), and the recipient email is
+  // the more useful identifier in both modes anyway.
+  titleFormat: "Invitation for {email}",
   compactLayout: ["email", "organization_id", "status"],
   // Custom actions — generic CRUD is suppressed (better-auth-managed).
   // Mirror the `invite_user` toolbar action from sys_user here so admins
@@ -1237,6 +1352,13 @@ var SysInvitation = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
+      // Inviting/managing invitations is a multi-org-only flow (the
+      // endpoint resolves an active org absent in single-org mode). Gate
+      // the admin-side actions on the multi-org flag (mirrors
+      // sys_organization.create_organization). The recipient-side
+      // accept/reject actions below stay record-gated — they are
+      // unreachable in single-org anyway (no invitation rows exist).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -1254,6 +1376,7 @@ var SysInvitation = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/cancel-invitation",
       recordIdParam: "invitationId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Cancel this invitation? The recipient will no longer be able to accept it.",
       successMessage: "Invitation canceled",
       refreshAfter: true
@@ -1267,6 +1390,7 @@ var SysInvitation = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
       bodyExtra: { resend: true },
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Invitation resent",
       refreshAfter: true,
       params: [
@@ -1451,6 +1575,10 @@ var SysTeam = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/create-team",
+      // Teams are nested inside organizations — a multi-org-only concept.
+      // Gate every team mutation on the multi-org flag so the affordances
+      // disappear in single-org (mirrors sys_organization.create_organization).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Team created",
       refreshAfter: true,
       params: [
@@ -1471,6 +1599,7 @@ var SysTeam = data.ObjectSchema.create({
       target: "/api/v1/auth/organization/update-team",
       recordIdParam: "teamId",
       bodyShape: { wrap: "data" },
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Team updated",
       refreshAfter: true,
       params: [
@@ -1489,6 +1618,7 @@ var SysTeam = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-team",
       recordIdParam: "teamId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Delete this team? Members will lose any team-scoped access. This cannot be undone.",
       successMessage: "Team deleted",
       refreshAfter: true
@@ -1599,6 +1729,10 @@ var SysTeamMember = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/add-team-member",
+      // Team membership lives under organizations — multi-org-only. Gate
+      // both mutations so they vanish in single-org (mirrors
+      // sys_organization.create_organization).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Team member added",
       refreshAfter: true,
       params: [
@@ -1619,6 +1753,7 @@ var SysTeamMember = data.ObjectSchema.create({
       locations: ["list_item"],
       type: "api",
       target: "/api/v1/auth/organization/remove-team-member",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Remove this user from the team? They will lose any team-scoped access.",
       successMessage: "Team member removed",
       refreshAfter: true,
@@ -3158,6 +3293,224 @@ var SysJwks = data.ObjectSchema.create({
     mru: false
   }
 });
+var SysSsoProvider = data.ObjectSchema.create({
+  name: "sys_sso_provider",
+  label: "SSO Provider",
+  pluralLabel: "SSO Providers",
+  icon: "shield-check",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth (@better-auth/sso) \u2014 see ADR-0024.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "External SSO identity providers (OIDC / SAML) this environment federates login to",
+  displayNameField: "provider_id",
+  titleFormat: "{provider_id}",
+  compactLayout: ["provider_id", "issuer", "domain"],
+  // All mutations go through @better-auth/sso's endpoints under
+  // /api/v1/auth/sso/* (register / delete-provider) rather than the generic
+  // data layer, so server-side config validation + secret handling run.
+  actions: [
+    {
+      name: "register_sso_provider",
+      label: "Register SSO Provider",
+      icon: "plus-circle",
+      variant: "primary",
+      mode: "create",
+      locations: ["list_toolbar"],
+      type: "api",
+      method: "POST",
+      target: "/api/v1/auth/sso/register",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", label: "Provider ID", type: "text", required: true, helpText: 'Stable identifier, e.g. "okta" or "acme-entra".' },
+        { name: "issuer", label: "Issuer URL", type: "text", required: true, helpText: "IdP issuer / discovery base, e.g. https://acme.okta.com." },
+        { name: "domain", label: "Email Domain", type: "text", required: true, helpText: "Users with this email domain are routed to this IdP." },
+        { name: "clientId", label: "Client ID", type: "text", required: true },
+        { name: "clientSecret", label: "Client Secret", type: "text", required: true }
+      ]
+    },
+    {
+      name: "delete_sso_provider",
+      label: "Delete SSO Provider",
+      icon: "trash-2",
+      variant: "danger",
+      mode: "delete",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "POST",
+      target: "/api/v1/auth/sso/delete-provider",
+      confirmText: "Delete this SSO provider? Users from its domain will no longer be able to sign in through it.",
+      successMessage: "SSO provider deleted",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", field: "provider_id", defaultFromRow: true, required: true }
+      ]
+    }
+  ],
+  listViews: {
+    all: {
+      type: "grid",
+      name: "all",
+      label: "All",
+      data: { provider: "object", object: "sys_sso_provider" },
+      columns: ["provider_id", "issuer", "domain", "created_at"],
+      sort: [{ field: "provider_id", order: "asc" }],
+      pagination: { pageSize: 50 }
+    }
+  },
+  fields: {
+    id: data.Field.text({ label: "ID", required: true, readonly: true, group: "System" }),
+    provider_id: data.Field.text({
+      label: "Provider ID",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      description: "Stable provider identifier (unique within the environment)",
+      group: "Identity"
+    }),
+    issuer: data.Field.text({
+      label: "Issuer",
+      required: true,
+      maxLength: 2048,
+      description: "IdP issuer URL",
+      group: "Identity"
+    }),
+    domain: data.Field.text({
+      label: "Email Domain",
+      required: true,
+      maxLength: 255,
+      description: "Email domain routed to this IdP (e.g. acme.com)",
+      group: "Identity"
+    }),
+    oidc_config: data.Field.textarea({
+      label: "OIDC Config",
+      required: false,
+      description: "JSON: clientId, clientSecret, endpoints, scopes, mapping, pkce (managed by better-auth)",
+      group: "Protocol"
+    }),
+    saml_config: data.Field.textarea({
+      label: "SAML Config",
+      required: false,
+      description: "JSON: entryPoint, cert, identifierFormat, mapping (managed by better-auth)",
+      group: "Protocol"
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "Registered By",
+      required: false,
+      description: "User who registered this provider",
+      group: "System"
+    }),
+    organization_id: data.Field.text({
+      label: "Organization",
+      required: false,
+      maxLength: 255,
+      description: "Organization scope (when org-scoped SSO is used)",
+      group: "System"
+    }),
+    created_at: data.Field.datetime({ label: "Created At", defaultValue: "NOW()", readonly: true, group: "System" }),
+    updated_at: data.Field.datetime({ label: "Updated At", defaultValue: "NOW()", readonly: true, group: "System" })
+  },
+  indexes: [
+    { fields: ["provider_id"], unique: true },
+    { fields: ["domain"] },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    // Mutations go through /api/v1/auth/sso/* (register / delete-provider);
+    // the generic data layer is read-only so sysadmins cannot bypass
+    // server-side validation / secret handling.
+    apiMethods: ["get", "list"],
+    trash: false,
+    mru: false
+  }
+});
+var SysScimProvider = data.ObjectSchema.create({
+  name: "sys_scim_provider",
+  label: "SCIM Provider",
+  pluralLabel: "SCIM Providers",
+  icon: "users",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth (@better-auth/scim) \u2014 see ADR-0071.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "SCIM 2.0 connections (bearer tokens) external IdPs use to provision/deprovision this environment's users",
+  displayNameField: "provider_id",
+  titleFormat: "{provider_id}",
+  compactLayout: ["provider_id", "organization_id"],
+  listViews: {
+    all: {
+      type: "grid",
+      name: "all",
+      label: "All",
+      data: { provider: "object", object: "sys_scim_provider" },
+      // scim_token is intentionally excluded — never surface the credential.
+      columns: ["provider_id", "organization_id", "created_at"],
+      sort: [{ field: "provider_id", order: "asc" }],
+      pagination: { pageSize: 50 }
+    }
+  },
+  fields: {
+    id: data.Field.text({ label: "ID", required: true, readonly: true, group: "System" }),
+    provider_id: data.Field.text({
+      label: "Provider ID",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      description: 'Stable SCIM provider identifier (e.g. "okta-scim")',
+      group: "Identity"
+    }),
+    scim_token: data.Field.text({
+      label: "SCIM Token (hash)",
+      required: false,
+      readonly: true,
+      maxLength: 1024,
+      description: "Hashed bearer credential for this SCIM connection \u2014 the plaintext is shown once at generate-token. Sensitive; do not expose.",
+      group: "Secret"
+    }),
+    organization_id: data.Field.text({
+      label: "Organization",
+      required: false,
+      maxLength: 255,
+      description: "Organization scope of this token (org-scoped tokens restrict provisioning to that org)",
+      group: "System"
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "Owned By",
+      required: false,
+      description: "User who generated this token (when provider-ownership is enabled)",
+      group: "System"
+    }),
+    created_at: data.Field.datetime({ label: "Created At", defaultValue: "NOW()", readonly: true, group: "System" }),
+    updated_at: data.Field.datetime({ label: "Updated At", defaultValue: "NOW()", readonly: true, group: "System" })
+  },
+  indexes: [
+    { fields: ["provider_id"], unique: true },
+    { fields: ["organization_id"] },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    // Mutations + token issuance go through @better-auth/scim's endpoints
+    // under /api/v1/auth/scim/*; the generic data layer is read-only so the
+    // credential cannot be written/bypassed through it.
+    apiMethods: ["list"],
+    trash: false,
+    mru: false
+  }
+});
 var SysNotification = data.ObjectSchema.create({
   name: "sys_notification",
   label: "Notification Event",
@@ -4613,7 +4966,7 @@ var SETUP_NAV_CONTRIBUTIONS = [
     items: [
       { id: "nav_users", type: "object", label: "Users", objectName: "sys_user", icon: "user" },
       { id: "nav_business_units", type: "object", label: "Business Units", objectName: "sys_business_unit", icon: "building", requiresObject: "sys_business_unit" },
-      { id: "nav_teams", type: "object", label: "Teams", objectName: "sys_team", icon: "users-round" },
+      { id: "nav_teams", type: "object", label: "Teams", objectName: "sys_team", icon: "users-round", requiresService: "org-scoping" },
       { id: "nav_organizations", type: "object", label: "Organizations", objectName: "sys_organization", icon: "building-2", requiresService: "org-scoping" },
       { id: "nav_invitations", type: "object", label: "Invitations", objectName: "sys_invitation", icon: "mail", requiresService: "org-scoping" }
     ]
@@ -4641,6 +4994,16 @@ var SETUP_NAV_CONTRIBUTIONS = [
     priority: BASE_PRIORITY,
     items: [
       { id: "nav_settings_hub", type: "url", label: "All Settings", url: "/apps/setup/system/settings", icon: "settings-2", requiredPermissions: ["manage_platform_settings"] },
+      // Workspace identity first — Localization (order 2) and Company (order 3)
+      // are the lowest-`order` settings manifests and the first thing a new
+      // company admin configures. They ship as `service-settings` manifests
+      // (tenant scope, read=`setup.access`) but were never pinned here, so they
+      // were reachable only by drilling into the "All Settings" hub. Mainstream
+      // admin consoles (Salesforce "Company Information", ServiceNow) surface
+      // both directly. No `requiredPermissions` — matches Branding (read perm is
+      // the app's base `setup.access`).
+      { id: "nav_settings_localization", type: "url", label: "Localization", url: "/apps/setup/system/settings/localization", icon: "globe" },
+      { id: "nav_settings_company", type: "url", label: "Company", url: "/apps/setup/system/settings/company", icon: "building-2" },
       { id: "nav_settings_branding", type: "url", label: "Branding", url: "/apps/setup/system/settings/branding", icon: "palette" },
       { id: "nav_settings_auth", type: "url", label: "Authentication", url: "/apps/setup/system/settings/auth", icon: "lock-keyhole", requiredPermissions: ["manage_platform_settings"] },
       { id: "nav_settings_mail", type: "url", label: "Email", url: "/apps/setup/system/settings/mail", icon: "mail", requiredPermissions: ["manage_platform_settings"] },
@@ -4668,8 +5031,12 @@ var SETUP_NAV_CONTRIBUTIONS = [
     items: [
       { id: "nav_oauth_apps", type: "object", label: "OAuth Applications", objectName: "sys_oauth_application", icon: "app-window" },
       { id: "nav_jwks", type: "object", label: "Signing Keys (JWKS)", objectName: "sys_jwks", icon: "key-round" },
-      { id: "nav_verifications", type: "object", label: "Verifications", objectName: "sys_verification", icon: "mail-check" },
-      { id: "nav_device_codes", type: "object", label: "Device Codes", objectName: "sys_device_code", icon: "qr-code" },
+      // `sys_verification` (email/phone tokens) and `sys_device_code` (OAuth
+      // device-grant codes) deliberately omit `list` from their `apiMethods`
+      // (sensitive, ephemeral secrets — not browsable), so an object/list-view
+      // nav entry for them can only ever render "failed to load". They're
+      // reachable by id (get) when needed; no browse menu. (Re-adding requires
+      // enabling `list` on the object — a security decision.)
       { id: "nav_accounts", type: "object", label: "Identity Links", objectName: "sys_account", icon: "link-2" },
       { id: "nav_user_preferences", type: "object", label: "User Preferences", objectName: "sys_user_preference", icon: "sliders" }
     ]
@@ -5055,7 +5422,13 @@ var ACCOUNT_APP = {
           objectName: "sys_member",
           viewName: "mine",
           icon: "building-2",
-          requiresObject: "sys_member"
+          // Membership is a multi-org concept: in single-org mode the
+          // `mine` view is always empty (no sys_organization rows, no
+          // auto-stamped memberships). Gate on the org-scoping service so
+          // this entry disappears entirely — matching Organizations/
+          // Invitations in setup-nav. `requiresObject: 'sys_member'` was
+          // the wrong gate (the system object is always registered).
+          requiresService: "org-scoping"
         }
       ]
     },
@@ -5148,6 +5521,12 @@ var SystemOverviewDashboard = ui.Dashboard.create({
       values: ["org_count"],
       title: "Organizations",
       type: "metric",
+      // Organizations only exist under multi-tenant org-scoping. In a
+      // single-tenant runtime the count is always 0 and the matching
+      // nav entries (nav_organizations / nav_invitations) are hidden via
+      // `requiresService: 'org-scoping'` — gate this KPI the same way so the
+      // overview doesn't dangle a metric the admin can't act on.
+      requiresService: "org-scoping",
       layout: { x: 3, y: 0, w: 3, h: 2 },
       colorVariant: "orange",
       description: "Total organizations on the platform"
@@ -10663,6 +11042,7 @@ var zhCN = {
         group_apps: { label: "\u5E94\u7528" },
         nav_marketplace_browse: { label: "\u6D4F\u89C8\u5E94\u7528\u5E02\u573A" },
         nav_marketplace_installed: { label: "\u5DF2\u5B89\u88C5\u5E94\u7528" },
+        nav_cloud_connection: { label: "\u4E91\u8FDE\u63A5" },
         group_people_org: { label: "\u4EBA\u5458\u4E0E\u7EC4\u7EC7" },
         group_access_control: { label: "\u8BBF\u95EE\u63A7\u5236" },
         group_approvals: { label: "\u5BA1\u6279" },
@@ -10677,6 +11057,7 @@ var zhCN = {
         nav_organizations: { label: "\u7EC4\u7EC7" },
         nav_invitations: { label: "\u9080\u8BF7" },
         nav_roles: { label: "\u89D2\u8272" },
+        nav_capabilities: { label: "\u80FD\u529B" },
         nav_permission_sets: { label: "\u6743\u9650\u96C6" },
         nav_sharing_rules: { label: "\u5171\u4EAB\u89C4\u5219" },
         nav_record_shares: { label: "\u8BB0\u5F55\u5171\u4EAB" },
@@ -10685,6 +11066,8 @@ var zhCN = {
         nav_approval_requests: { label: "\u5BA1\u6279\u7533\u8BF7" },
         nav_approval_actions: { label: "\u5BA1\u6279\u5386\u53F2" },
         nav_settings_hub: { label: "\u5168\u90E8\u8BBE\u7F6E" },
+        nav_settings_localization: { label: "\u672C\u5730\u5316" },
+        nav_settings_company: { label: "\u516C\u53F8\u4FE1\u606F" },
         nav_settings_mail: { label: "\u90AE\u4EF6" },
         nav_settings_branding: { label: "\u54C1\u724C" },
         nav_settings_auth: { label: "\u8BA4\u8BC1" },
@@ -10698,10 +11081,9 @@ var zhCN = {
         nav_sessions: { label: "\u4F1A\u8BDD" },
         nav_audit_logs: { label: "\u5BA1\u8BA1\u65E5\u5FD7" },
         nav_notifications: { label: "\u901A\u77E5" },
+        nav_datasources: { label: "\u6570\u636E\u6E90" },
         nav_oauth_apps: { label: "OAuth \u5E94\u7528" },
         nav_jwks: { label: "\u7B7E\u540D\u5BC6\u94A5 (JWKS)" },
-        nav_verifications: { label: "\u9A8C\u8BC1\u8BB0\u5F55" },
-        nav_device_codes: { label: "\u8BBE\u5907\u4EE3\u7801" },
         nav_accounts: { label: "\u8EAB\u4EFD\u94FE\u63A5" },
         nav_user_preferences: { label: "\u7528\u6237\u504F\u597D" },
         nav_metadata: { label: "\u5168\u90E8\u5143\u6570\u636E" }
@@ -23207,10 +23589,12 @@ exports.SysOrganization = SysOrganization;
 exports.SysOrganizationDetailPage = SysOrganizationDetailPage;
 exports.SysReportSchedule = SysReportSchedule;
 exports.SysSavedReport = SysSavedReport;
+exports.SysScimProvider = SysScimProvider;
 exports.SysSecret = SysSecret;
 exports.SysSession = SysSession;
 exports.SysSetting = SysSetting;
 exports.SysSettingAudit = SysSettingAudit;
+exports.SysSsoProvider = SysSsoProvider;
 exports.SysTeam = SysTeam;
 exports.SysTeamMember = SysTeamMember;
 exports.SysTwoFactor = SysTwoFactor;